Data Processing Addendum

This Data Processing Addendum ("DPA") forms part of the Terms of Service between Tech Mage (Pty) Ltd ("Tech Mage", "processor") and the customer that uses Prubex for an organisation ("customer", "controller"). It applies whenever Tech Mage processes personal data on the customer's behalf. It meets section 21 of POPIA (operators) and Article 28 of the GDPR (processors). Accepting the Terms of Service accepts this DPA. No separate signature is needed.

1. Roles and scope

• The customer is the responsible party (POPIA) or controller (GDPR) for the personal data in the mailboxes, calendars and contacts it connects to Prubex ("customer data").
• Tech Mage processes customer data only as the customer's operator or processor.
• Tech Mage is a controller only for its own account, billing and security records, which are covered by the Privacy Policy.

2. Details of the processing

Item	Detail
Subject matter	Giving the customer's authorised AI agents and users access to connected email and calendar accounts
Duration	While the customer uses Prubex, then until deletion under section 9
Nature	Fetching, transmitting, filtering against the customer's rules, and briefly holding data (sends awaiting approval, uploaded attachments)
Purpose	Providing Prubex as the customer instructs through its configuration, its agents' requests and its approvals
Personal data	Email messages and attachments, calendar events, contact details, email addresses and names in them
Data subjects	The customer's users, and the people they correspond or meet with
Special categories	Not intended. Mail can contain anything its senders wrote, so the customer decides what to connect

3. Instructions

Tech Mage processes customer data only on the customer's documented instructions. The Terms, this DPA, the customer's settings in Prubex and the requests of agents the customer has authorised are those instructions. If Tech Mage believes an instruction breaks data protection law, it will say so. If the law requires other processing, Tech Mage will tell the customer first unless the law forbids it.

4. Confidentiality

Everyone at Tech Mage who could access customer data is bound to confidentiality. No one at Tech Mage reads customer data, except where the customer asks for help with a specific item, or to keep the service secure or meet the law.

5. Security

Tech Mage keeps appropriate technical and organisational measures in place, including:

• credentials for connected accounts encrypted with AES-256-GCM, with keys held in Azure Key Vault that the application can use but not export;
• message and event content passed through rather than stored; a send awaiting approval is encrypted by Prubex and deleted no later than 7 days after it is decided or expires; uploaded files and the copies a held send keeps are protected by Azure Storage encryption at rest and deleted within 24 hours, or with their held send (9 days at most);
• TLS for every connection; API keys stored only as keyed hashes; OAuth tokens hashed, with refresh token rotation and reuse detection;
• the customer's own controls applied to every request: scopes, account limits, recipient lists, daily caps and send approvals, with an audit log of every action;
• least-privilege access to production through managed identities, with no routine human access to the database;
• protection against server-side request forgery for user-supplied hosts, security headers, rate limits, dependency scanning and regular security reviews;
• hosting in Microsoft Azure's South Africa North region, with point-in-time database backups.

6. Subprocessors

The customer authorises the subprocessors on the Subprocessors page. Tech Mage binds each one to data protection terms at least as protective as this DPA, and remains responsible for them. Tech Mage gives at least 30 days' notice of a new subprocessor to customers who ask for notices at hello@prubex.com. A customer may object on reasonable data protection grounds; if we cannot resolve the objection, the customer may cancel at any time. The unused part of a period is not refunded, as the Refund Policy provides.

7. Helping the customer

Tech Mage helps the customer, as far as it reasonably can, to answer data subjects' requests (the dashboard's export, disconnect and deletion tools do most of this), and with security, breach notification, impact assessments and consultations with regulators.

8. Personal data breaches

Tech Mage tells the customer without undue delay, and in any case within 72 hours, after becoming aware of a breach affecting customer data. The notice says what is known (what happened, the data and people affected, the likely consequences and what is being done) and is updated as more is learned.

9. Deletion

When the customer disconnects an account, Prubex deletes its credentials at once. When the customer deletes a workspace, Prubex revokes its access at each provider at once and deletes the workspace's customer data within 30 days. The customer can export its data before it deletes anything.

10. Audits

Tech Mage makes available the information needed to show it meets this DPA, including its security documentation, and answers the customer's reasonable written questions about it. That documentation and those answers are how the customer verifies compliance; on-site or third-party audits are not offered.

11. International transfers

Customer data is hosted in South Africa. Where data protection law treats processing in South Africa, or by a subprocessor elsewhere, as a transfer that needs safeguards, the EU Standard Contractual Clauses (controller-to-processor or processor-to-processor module, as fits) and, for the UK, the International Data Transfer Addendum are incorporated into this DPA. POPIA section 72 transfers rely on the same safeguards.

12. Liability and order of precedence

Liability under this DPA follows the Terms of Service. If this DPA and the Terms conflict on data protection, this DPA wins. If the Standard Contractual Clauses apply and conflict with either, the Clauses win.